HKMA Cyber Resilience Assessment Framework (C-RAF) 7.2.B: 7.2 Third-party management: baseline level

Baseline control principles for third-party management (required of every AI (minimum for a low inherent risk)). Formal contracts for such third parties address security and privacy requirements, acknowledge the third party's responsibility for the security and privacy of the data, set the institution's recourse if requirements are not met, establish responsibilities for responding to security incidents, and set security requirements for returning or destroying data at termination; risk-based cyber due diligence is done before contracts are signed; a list of these third parties is kept. In 2.0 the institution also performs risk-based assessments or audits of the controls providers use to safeguard data and support incident response, disaster recovery and resilience.